linux.git/drivers/net/wireless/ti, branch v4.4.12

wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)

2016-02-17T20:30:56+00:00

commit e47301b06d5a65678690f04c2248fd181db1e59a upstream.

Fix the below Oops when trying to modprobe wlcore_spi.
The oops occurs because the wl1271_power_{off,on}()
function doesn't check the power() function pointer.

[   23.401447] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[   23.409954] pgd = c0004000
[   23.412922] [00000000] *pgd=00000000
[   23.416693] Internal error: Oops: 80000007 [#1] SMP ARM
[   23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev
omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23
c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma
snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[   23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted
4.2.0-00002-g951efee-dirty #233
[   23.461720] Hardware name: Generic AM33XX (Flattened Device Tree)
[   23.468123] Workqueue: events request_firmware_work_func
[   23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000
[   23.479341] PC is at 0x0
[   23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore]
[   23.488074] pc : [<00000000>]    lr : []    psr: 60000013
[   23.488074] sp : de4efe50  ip : 00000002  fp : 00000000
[   23.500162] r10: de7cdd00  r9 : dc848800  r8 : bf27af00
[   23.505663] r7 : bf27a1a8  r6 : dcbd8a80  r5 : dce0e2e0  r4 :
dce0d2e0
[   23.512536] r3 : 00000000  r2 : 00000000  r1 : 00000001  r0 :
dc848810
[   23.519412] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment kernel
[   23.527109] Control: 10c5387d  Table: 9cb78019  DAC: 00000015
[   23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218)
[   23.539760] Stack: (0xde4efe50 to 0xde4f0000)

[...]

[   23.665030] [] (wl12xx_set_power_on [wlcore]) from
[] (wlcore_nvs_cb+0x118/0xa4c [wlcore])
[   23.675604] [] (wlcore_nvs_cb [wlcore]) from []
(request_firmware_work_func+0x30/0x58)
[   23.685784] [] (request_firmware_work_func) from
[] (process_one_work+0x1b4/0x4b4)
[   23.695591] [] (process_one_work) from []
(worker_thread+0x3c/0x4a4)
[   23.704124] [] (worker_thread) from []
(kthread+0xd4/0xf0)
[   23.711747] [] (kthread) from []
(ret_from_fork+0x14/0x3c)
[   23.719357] Code: bad PC value
[   23.722760] ---[ end trace 981be8510db9b3a9 ]---

Prevent oops by validationg power() pointer value before
calling the function.

Signed-off-by: Uri Mashiach 
Acked-by: Igor Grinberg 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

wlcore/wl12xx: spi: fix oops on firmware load

2016-02-17T20:30:56+00:00

commit 9b2761cb72dc41e1948c8a5512b4efd384eda130 upstream.

The maximum chunks used by the function is
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
The original commands array had space for
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands.
When the last chunk is used (len > 4 * WSPI_MAX_CHUNK_SIZE), the last
command is stored outside the bounds of the commands array.

Oops 5 (page fault) is generated during current wl1271 firmware load
attempt:

root@debian-armhf:~# ifconfig wlan0 up
[  294.312399] Unable to handle kernel paging request at virtual address
00203fc4
[  294.320173] pgd = de528000
[  294.323028] [00203fc4] *pgd=00000000
[  294.326916] Internal error: Oops: 5 [#1] SMP ARM
[  294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx
wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common
wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys
hwmon
[  294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted
4.2.0-00002-g3e9ad27-dirty #78
[  294.360154] Hardware name: Generic AM33XX (Flattened Device Tree)
[  294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000
[  294.372236] PC is at __spi_validate+0xa8/0x2ac
[  294.376902] LR is at __spi_sync+0x78/0x210
[  294.381200] pc : []    lr : []    psr: 60000013
[  294.381200] sp : de551998  ip : de5519d8  fp : 00200000
[  294.393242] r10: de551c8c  r9 : de5519d8  r8 : de3a9000
[  294.398730] r7 : de3a9258  r6 : de3a9400  r5 : de551a48  r4 :
00203fbc
[  294.405577] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 :
de3a9000
[  294.412420] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment user
[  294.419918] Control: 10c5387d  Table: 9e528019  DAC: 00000015
[  294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218)
[  294.432437] Stack: (0xde551998 to 0xde552000)

...

[  294.883613] [] (__spi_validate) from []
(__spi_sync+0x78/0x210)
[  294.891670] [] (__spi_sync) from []
(wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi])
[  294.901661] [] (wl12xx_spi_raw_write [wlcore_spi]) from
[] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore])
[  294.914038] [] (wlcore_boot_upload_firmware [wlcore]) from
[] (wl12xx_boot+0xc10/0xfac [wl12xx])
[  294.925161] [] (wl12xx_boot [wl12xx]) from []
(wl1271_op_add_interface+0x5b0/0x910 [wlcore])
[  294.936364] [] (wl1271_op_add_interface [wlcore]) from
[] (ieee80211_do_open+0x44c/0xf7c [mac80211])
[  294.947963] [] (ieee80211_do_open [mac80211]) from
[] (__dev_open+0xa8/0x110)
[  294.957307] [] (__dev_open) from []
(__dev_change_flags+0x88/0x148)
[  294.965713] [] (__dev_change_flags) from []
(dev_change_flags+0x18/0x48)
[  294.974576] [] (dev_change_flags) from []
(devinet_ioctl+0x6b4/0x7d0)
[  294.983191] [] (devinet_ioctl) from []
(sock_ioctl+0x1e4/0x2bc)
[  294.991244] [] (sock_ioctl) from []
(do_vfs_ioctl+0x420/0x6b0)
[  294.999208] [] (do_vfs_ioctl) from []
(SyS_ioctl+0x6c/0x7c)
[  295.006880] [] (SyS_ioctl) from []
(ret_fast_syscall+0x0/0x54)
[  295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008)
[  295.021544] ---[ end trace 66ed188198f4e24e ]---

Signed-off-by: Uri Mashiach 
Acked-by: Igor Grinberg 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'spi-v4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

2015-11-05T21:15:12+00:00

Pull spi updates from Mark Brown:
 "Quite a lot of activity in SPI this cycle, almost all of it in drivers
  with a few minor improvements and tweaks in the core.

   - Updates to pxa2xx to support Intel Broxton and multiple chip selects.
   - Support for big endian in the bcm63xx driver.
   - Multiple slave support for the mt8173
   - New driver for the auxiliary SPI controller in bcm2835 SoCs.
   - Support for Layerscale SoCs in the Freescale DSPI driver"

* tag 'spi-v4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (87 commits)
  spi: pxa2xx: Rework self-initiated platform data creation for non-ACPI
  spi: pxa2xx: Add support for Intel Broxton
  spi: pxa2xx: Detect number of enabled Intel LPSS SPI chip select signals
  spi: pxa2xx: Add output control for multiple Intel LPSS chip selects
  spi: pxa2xx: Use LPSS prefix for defines that are Intel LPSS specific
  spi: Add DSPI support for layerscape family
  spi: ti-qspi: improve ->remove() callback
  spi/spi-xilinx: Fix race condition on last word read
  spi: Drop owner assignment from spi_drivers
  spi: Add THIS_MODULE to spi_driver in SPI core
  spi: Setup the master controller driver before setting the chipselect
  spi: dw: replace magic constant by DW_SPI_DR
  spi: mediatek: mt8173 spi multiple devices support
  spi: mediatek: handle controller_data in mtk_spi_setup
  spi: mediatek: remove mtk_spi_config
  spi: mediatek: Update document devicetree bindings to support multiple devices
  spi: fix kernel-doc warnings about missing return desc in spi.c
  spi: fix kernel-doc warnings about missing return desc in spi.h
  spi: pxa2xx: Align a few defines
  spi: pxa2xx: Save other reg_cs_ctrl bits when configuring chip select
  ...

spi: Drop owner assignment from spi_drivers

2015-10-28T01:30:17+00:00

An spi_driver does not need to set an owner, it will be populated by the
driver core.

Signed-off-by: Andrew F. Davis 
Acked-by: Jonathan Cameron 
Signed-off-by: Mark Brown

cfg80211: Add multiple scan plans for scheduled scan

2015-10-13T08:35:26+00:00

Add the option to configure multiple 'scan plans' for scheduled scan.
Each 'scan plan' defines the number of scan cycles and the interval
between scans. The scan plans are executed in the order they were
configured. The last scan plan will always run infinitely and thus
defines only the interval between scans.
The maximum number of scan plans supported by the device and the
maximum number of iterations in a single scan plan are advertised
to userspace so it can configure the scan plans appropriately.

When scheduled scan results are received there is no way to know which
scan plan is being currently executed, so there is no way to know when
the next scan iteration will start. This is not a problem, however.
The scan start timestamp is only used for flushing old scan results,
and there is no difference between flushing all results received until
the end of the previous iteration or the start of the current one,
since no results will be received in between.

Signed-off-by: Avraham Stern 
Signed-off-by: Luca Coelho 
Signed-off-by: Johannes Berg

Merge tag 'wireless-drivers-next-for-davem-2015-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

2015-10-13T02:39:18+00:00

Kalle Valo says:

====================
Major changes:

iwlwifi

* some debugfs improvements
* fix signedness in beacon statistics
* deinline some functions to reduce size when device tracing is enabled
* filter beacons out in AP mode when no stations are associated
* deprecate firmwares version -12
* fix a runtime PM vs. legacy suspend race
* one-liner fix for a ToF bug
* clean-ups in the rx code
* small debugging improvement
* fix WoWLAN with new firmware versions
* more clean-ups towards multiple RX queues;
* some rate scaling fixes and improvements;
* some time-of-flight fixes;
* other generic improvements and clean-ups;

brcmfmac

* rework code dealing with multiple interfaces
* allow logging firmware console using debug level
* support for BCM4350, BCM4365, and BCM4366 PCIE devices
* fixed for legacy P2P and P2P device handling
* correct set and get tx-power

ath9k

* add support for Outside Context of a BSS (OCB) mode

mwifiex

* add USB multichannel feature
====================

Signed-off-by: David S. Miller

wlcore: align reg_ch_conf_last[] to 64bit

2015-09-29T07:44:27+00:00

Align fields reg_ch_conf_last and reg_ch_conf_pending of
struct wl1271{} to 64bit.

Without this, on 64bit ARM, wlcore_set_pending_regdomain_ch() fails at
the point it calls set_bit(ch_bit_idx, (long*)wl->reg_ch_conf_pending);
Here is the error message while doing iw wlan0 scan or connect:

[   10.666857] wlcore: IRQ work
[   10.670046] wlcore: intr: 0x40 (fw_rx_counter = 1, drv_rx_counter = 0, tx_results_counter = 0)
[   10.678697] wlcore: WL1271_ACX_INTR_DATA
[   10.682810] Unhandled fault: alignment fault (0x96000021) at 0xffffffc037a817f4
[   10.690139] Internal error: : 96000021 [#1] PREEMPT SMP
[   10.695366] Modules linked in:
[   10.698437] CPU: 3 PID: 894 Comm: irq/60-wl18xx Tainted: G        W       4.2.0-rc6-linaro-hikey #2
[   10.707501] Hardware name: HiKey Development Board (DT)
[   10.712733] task: ffffffc03a9d1680 ti: ffffffc039e18000 task.ti: ffffffc039e18000
[   10.720239] PC is at set_bit+0x14/0x30
[   10.724002] LR is at wlcore_set_pending_regdomain_ch+0x40/0x4c

Signed-off-by: Guodong Xu 
Signed-off-by: Kalle Valo

net/wireless/wl18xx: Add missing MODULE_FIRMWARE

2015-09-29T07:35:16+00:00

Fixes the output of 'modinfo --field firmware'.

Signed-off-by: Geoff Levand 
Signed-off-by: Kalle Valo

mac80211: allow to transmit A-MSDU within A-MPDU

2015-09-22T13:21:23+00:00

Advertise the capability to send A-MSDU within A-MPDU
in the AddBA request sent by mac80211. Let the driver
know about the peer's capabilities.

Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Johannes Berg

wl18xx: add diversity statistics

2015-08-18T06:06:06+00:00

Add diversity statistics and sync the driver
statistics acx and debugfs representation
with the current fw api.

Signed-off-by: Guy Mishol 
Signed-off-by: Kalle Valo